User Agent Client Hints

[yoavweiss]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: User Agent Client Hints
• Specification or proposal URL: https://tools.ietf.org/html/draft-west-ua-client-hints-00
• Mozillians who can provide input: @martinthomson , @annevk

Other information

The User Agent header that is being sent today on every request provides an excellent source of entropy that can be used to passively fingerprint users. It would be great if browsers could stop sending that information by default to all servers, regardless of whether those servers need it or not.

The User Agent Client Hint proposal is destined to replace the User Agent header, to achieve the following:

• Send significantly less information by default (only the browser brand and major version).
• Split the current entropy-laden string into several separate hints/attributes, enabling servers to request some information (e.g. minor version number), without being exposed to other information (e.g. CPU architecture).
• Enable 1P servers to opt-in to receive that information as HTTP request headers, as well as in a JS API, while giving 3P servers access to that information only if delegated from the 1P.

The above will enable browsers to keep track of servers that collect that information, and take actions to protect users' privacy in cases where that collection is likely abusing it.

Another interesting characteristic of reseting access to the UA string is that it can allow browsers to apply GREASE to the new values, in order to prevent the negative implications of UA sniffing seen on the web today.

[dbaron]

So it's worth noting explicitly that a bunch of the comments made in #79 apply here -- but at the same time this is a separate question from the one in #79 that we ought to discuss.

[yoavweiss]

/cc @miketaylr - who shown interest in the feature when we discussed it at ViewSource

[miketaylr]

Hey @yoavweiss - sorry for the delay here. I've been having discussions with Tanvi and @martinthomson about the User Agents Hints proposal and here's some draft language that could maybe result in a position:

---

Description

The UA Hints proposal aims to solve the following problems associated with the User Agent (UA) string: UA sniffing, UA spoofing, and an entropy-rich target for fingerprinting. The proposal is to build on top of the Client Hints infrastructure and solve these problems over time.

(Draft) Mozilla's Position

Using Client Hints to deliver info derived from the User Agent header for servers who specifically request this information may reduce the number of parties that can use this information for passively fingerprinting users. However, we could reduce this even further by freezing the User Agent string and requiring resources to actively request this information via the proposed NavigatorUAData interface JS APIs. This would also allow us to audit the callers. At this time, freezing the User Agent string without any client hints—seems worth-prototyping. We look forward to learning from other vendors who implement the “GREASE-like UA Strings” proposal and its effects on site compatibility.

---

Less formal version:

We're very interested in the freezing UA string stuff and NavigatorUAData JS APIs, and think those are worth prototyping. Personally, the GREASE-like stuff is interesting but slightly scary. I'd love to see Chrome turn that on in Canary at some point and see what happens.

But I don't think the positive points change our position on Client HInts (which is currently "non-harmful"). @martinthomson could probably expound on that.

[adamroach]

Thanks, @miketaylr -- after double-checking with Martin, and reading @dbaron's comment above as not varying from the related Client Hints position, I'm closing this and adding your proposed text to the spreadsheet.

[BenjaminAster]

Chromium has been shipping User Agent Client Hints for over a year now. I understand that you are skeptical about the Sec-UA-CH headers, but an implementation of the NavigatorUAData API in JavaScript would be awesome as it would make browser- and OS-detection a lot simpler. In Gecko and WebKit, you currently have to parse the navigator.userAgent string for this, which is very impractical. (And Chromium DevTools show an issue when using it – telling me to migrate to navigator.userAgentData). I'd be pleased if Mozilla could give an update on this, and eventually implement at least NavigatorUAData in Gecko.

[martinthomson]

https://bugzilla.mozilla.org/show_bug.cgi?id=1750143 tracks the implementation. I can't say anything about priority, but you can follow along there @BenjaminAster.